Scope and roles
These terms form part of our terms of service. The shop is the controller and 1T3chSoftware LTD, a company registered in England and Wales is the processor of the personal data of the shop’s customers that we process to provide the service.
Details of the processing
| Subject matter | Providing the till, ordering website, customer app, back office and related features. |
|---|---|
| Duration | While the agreement lasts, and afterwards only as long as needed to return or delete the data. |
| Nature and purpose | Storing, organising and displaying orders; taking payments through Stripe; sending order emails and notifications; reports; marketing the shop chooses to send. |
| Personal data | Names, contact details, delivery addresses, order history, notes including allergy information, marketing choices, loyalty stamps, notification subscriptions. |
| Data subjects | The shop’s customers, and its staff where they appear in order records. |
Our obligations
We will:
- Process the data only on the shop’s documented instructions, which include these terms and the shop’s use of the service, unless the law requires otherwise.
- Make sure everyone who handles the data is bound by confidentiality.
- Keep appropriate technical and organisational security measures in place, including separating each shop’s data, encryption in transit, restricted access and backups.
- Help the shop respond to requests from individuals exercising their rights, including through the export and deletion tools in the admin.
- Help the shop with security, breach notification and data protection impact assessments, taking into account the information available to us.
- Tell the shop without undue delay after becoming aware of a personal data breach affecting its data.
- At the end of the agreement, let the shop export its data and then delete it, unless the law requires us to keep it.
- Make available the information needed to show we meet these obligations, and allow reasonable audits on reasonable notice.
Sub-processors
The shop authorises us to use the sub-processors listed below. We have written contracts with them giving the data the same level of protection. We will tell shops before adding or replacing a sub-processor, and a shop may object on reasonable data protection grounds.
| Supplier | What they do for us | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | European Union (Ireland) |
| Stripe | Card payments, payouts to shops and card readers | UK, EU and United States |
| Resend | Sending order and account emails | United States |
| Namecheap | Server that delivers website pages (no order data is stored on it) | Varies by data centre |
| Ideal Postcodes and postcodes.io | Looking up addresses from a postcode | United Kingdom |
| Browser push services (Apple, Google, Mozilla) | Delivering notifications a customer has switched on | Worldwide |
| Meta Platforms | Publishing a shop's posts, only if the shop connects Facebook or Instagram | Ireland and United States |
| Google (Gemini) and OpenAI | Drafting marketing post text for a shop; no customer data is sent | United States |
International transfers
We transfer data outside the UK only with appropriate safeguards, as described in our privacy policy.